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REMARKS 

Claims 1-32 are pending, in which no claims are currently amended, canceled, 
withdrawn, or newly presented. 

The Office Action mailed January 27, 2005 rejected claims 1, 5-7, 9, 13-15, 17-20, 22-23, 
and 31-32 under 35 U.S.C. § 103(a) as obvious over Ji et al (U.S. 5,623,600) in view of Xu 
(U.S. Patent Application Publication No. 2002/0032766) and claims 2-4, 8, 10-12, 16, and 24-30 
under 35 U.S.C. § 103(a) as obvious over Ji et al in view of Xu and further in view of Wells 
(U.S. 6,338,141). 

Claim 21 was not rejected and is thus presumptively allowed pursuant to 37 CFR §1.104 (b) 
and (c)(1). 

Applicants respectfully traverse the rejections under 35 U.S.C. § 103, in that none of Ji et 
al, Xu, nor Wells, singly or in combination, discloses the claimed features. 

For example, independent claims 1, 8, 9, and 16 each include the feature "distributing a 
common copy of the flow to each of the scanning computer systems in parallel." Independent 
claims 17, 18, and 19 each recite "duplicating the flow to produce a plurality of common 
copies of the flow." Independent claims 20 and 21 each recite "receiving respective common 
copies of a flow of content from the front-end processor in parallel." Independent claims 22, 
25, and 28 each include the feature "receiving an alarm ... when a common flow of content 
scanned by the scanning computer systems in parallel contains malicious code, said common 
flow including at least one of a hypertext markup file and a transferred file." 

Claim 1 clearly recites, "a plurality of scanning computer systems configured for 
scanning content for malicious code and generating an alarm when the content contains 
malicious code; and a front-end processor, coupled to the scanning computer systems, 
configured for receiving a flow of content from an external network and distributing a 
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common copy of the flow to each of the scanning computer systems in parallel for 
scanning." Regarding claims 1 and 9, the Office Action (p. 3) correctly acknowledges, "Ji fails 
to teach 'a plurality of scanning computer systems' and distributing 'a common copy of the flow 
to each of the scanning computer systems in parallel for scanning'." The previous Office Action 
also correctly acknowledged this deficiency, and applied Shanklin et aL (U.S. 6,578,147) for a 
supposed teaching of "parallel sensors" (Office Action dated May 19, 2004, page 3, line 20 - 
page 4, line 13). The present Office Action, having dropped its application of Shanklin et aL, 
apparently in response to persuasive arguments by Applicants, now asserts instead, "the 
examiner asserts that the use of multiple virus scanning devices scanning a common copy of the 
flow in parallel is well known in the art." (Office Action, p. 3, lines 3-4) The Examiner has 
apparently tried, but failed to produce evidence to support the assertion regarding this feature, 
and now relies solely on the "well known in the art" assertion to reject the claims. 

The APA requires the Patent Office to articulate and place on the record the "common 
knowledge" used to negate patentability. In re Zurko, No. 96-1285 (Fed. Cir., Aug. 2, 2001). In 
re Lee, 211 F.3d 1338, 1344-45, 61 USPQ2d 1430, 1434-35 (Fed. Cir. 2002). Ordinarily, there 
must be some form of evidence in the record to support an assertion of common knowledge. See 
Lee, 211 F.3d at 1344-45, 61 USPQ2d at 1434-35 (Fed. Cir. 2002); Zurko, 258 F.3d at 1386, 59 
USPQ2d at 1697 (holding that general conclusions concerning what is "basic knowledge" or 
"common sense" to one of ordinary skill in the art without specific factual findings and some 
concrete evidence in the record to support these findings will not support an obviousness 
rejection). The Office Action has failed to produce specific factual findings and some concrete 
evidence to support these findings, and thus has failed in its rejection of the claims. Applicants 
respectfully request that such evidence be produced in a next Office Action, or that the rejection 
be withdrawn. 
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The Office Action then leaps to the conclusion, "It would have been obvious to one of 
ordinary skill in the art to modify Ji's scanning system to incorporate a plurality of virus scanning 
systems for scanning a common copy of the flow in parallel because different scanners with 
different capabilities are used as a 'safety net' to improve the chances of detecting a virus, Xu, 
page 18, paragraphs 228 (Xu)." 

Xu states, at page 1 8, 1 228: 

In FIG. 23, the ISP network 2390 includes a packeting engine 2300 
between clients 2321-2323 and the network service providers 2381-2383 coupled 
to the Internet 2385. The packeting engine 2300 directs the client packets through 
a series of appliances, including an intrusion detection system 2351 one or more 
virus scanning devices 2352-2353, and one or more of firewalls 2361-2363. 
Since companies that create virus scanning software differ in their capabilities to 
detect viruses and to issue timely virus signature updates, multiple virus scanning 
devices may be used as a "safety net" to improve the chances of detecting a virus. 
In previous examples of the invention, embodiments of a packeting engine used a 
service IP address to direct packets and disregarded the client's address. To 
perform its role in the ISP solution, an embodiment of a packeting engine 2300 
can be configured to do just the opposite, i.e., use the client's IP address as the 
service IP address. Therefore, the sequence of appliances is determined from 
the service IP address, which is actually the client address that was assigned by 
the ISP 2390. 



Xu specifically requires that processing of packets be performed by predefined, specific 
sequences of appliances such as the virus scanning devices 2352 and 2353. The cited portion of 
Xu refers to the ordering of a processing sequence as being determined by a service IP address, 
and thus Xu has nothing to do with the Office Action's assertion of "scanning a common copy of 
the flow in parallel," but instead teaches away from such parallel operations. It is improper to 
combine references where the references teach away from their combination. In re Grasselli, 
713 F.2d 731, 218 USPQ 769 (Fed. Cir. 1983). A prior art reference must be considered in its 
entirety including portions that would lead away from the claimed invention. W.L. Gore & 
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Associates, Inc. v. Garlock, Inc., 721 F.2d 1540, 220 USPQ 303 (Fed. Cir. 1983), cert denied, 
469 U.S. 851 (1984). 

Further, obviousness rejections require some evidence in the prior art of a teaching, 
motivation, or suggestion to combine and modify the prior art references. See, e.g., McGinley v. 
Franklin Sports, Inc., 262 F.3d 1339, 1351-52, 60 USPQ2d 1001, 1008 (Fed. Cir. 2001); Brown 
& Williamson Tobacco Corp. v. Philip Morris Inc., 229 F.3d 1120, 1124-25, 56 USPQ2d 1456, 
1459 (Fed. Cir. 2000); In re Dembiczak, 175 F.3d 994, 999, 50 USPQ2d 1614, 1617 (Fed. Cir. 
1999). The Office Action has failed to provide any such evidence. 

Moreover, Applicants respectfully submit that "a need for a malicious code detection 
system and methodology with the good anti-viral coverage of multiple anti-virus scanners but 
characterized by the low latency commensurate with that of a single anti-virus scanner" was 
recognized by the Applicants (specification, f 9), and was solved by the present claimed 
invention (See, e.g., specification, f 10). It is well settled that the problem addressed and solved 
by a claimed invention must be given consideration in resolving the ultimate legal conclusion of 
obviousness under 35 U.S.C. § 103. North American Vaccine, Inc. v. American Cyanamid Co., 1 
F.3d 1571, 28 USPQ 1333 (Fed. Cir. 1993); In re Dillon, 919 F.2d 688, 16 USPQ2d 1897 (Fed. 
Cir. 1990); Northern Telecom, Inc. v. Datapoint Corp., 908 F.2d 931, 15 USPQ 1321 (Fed. Cir. 
1990); Jones v. Hardy, 727 F.2d 1524, 220 USPQ 1021 (Fed. Cir. 1984). The Office Action has 
failed in this regard as well, instead applying impermissible hindsight to assert that features 
which are not disclosed or suggested by any applied references are "well known in the art." 

Further, Applicants respectfully submit that the reasoning that the Examiner puts forth for 
the rejection with respect to the Examiner's assertion regarding "the use of multiple virus 
scanning devices scanning a common copy of the flow in parallel" contravenes 35 U.S.C. § 132, 
which requires the Director to "notify the applicant thereof, stating the reasons for such 
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rejection." This section is violated if the rejection "is so uninformative that it prevents the 
applicant from recognizing and seeking to counter the grounds for rejection." Chester v. Miller, 
906 F.2d 1574, 15 USPQ2d 1333 (Fed. Cir. 1990). This policy is captured in the Manual of 
Patent Examining Procedure. For example, MPEP § 706 states that "[t]he goal of examination is 
to clearly articulate any rejection early in the prosecution process so that applicant has the 
opportunity to provide evidence of patentability and otherwise respond completely at the earliest 
opportunity." Furthermore, MPEP § 706.02(j) indicates that: "[i]t is important for an examiner 
to properly communicate the basis for a rejection so that the issues can be identified early and the 
applicant can be given fair opportunity to reply." 

Furthermore, 35 U.S.C. § 103 requires each limitation to be found in the references and a 
teaching for the combination or modification of the references to flow from the references 
themselves and not from generalities. The Office Action has failed at least in these regards, and 
thus, the rejection of the claims should be withdrawn. 

With regard to claims 5, 13, and 31-32, the Office Action (p. 3) further correctly 
acknowledges, "Ji fails to teach scanning computer systems configured to execute respective 
anti-virus scanning software having different, corresponding coverage of malicious code," then 
again makes a logical leap to assert, "However, the examiner asserts that the use of multiple virus 
scanning devices with different detection software and with different coverage of malicious code 
is well known in the art," concluding, "It would have been obvious to one of ordinary skill in 
the art to modify the Ji's scanner to incorporate virus scanning software differ in their capabilities 
as a 'safety net' to improve the chances of detecting a virus, Xu, page 18, paragraphs 228." 
Applicants respectfully request that evidence supporting the "well known in the art" assertion be 
produced in a next Office Action, or that the rejection be withdrawn. Similarly to the reasons 



17 



.09/862,851 Patent 
previously preferred regarding claims 1 and 9, the rejection of claims 5-7, 13-15, 17-20, 22-23, 
and 31-32 should be withdrawn. 

With regard to dependent claims 2-4 .and 10-12, the addition of Wells, which is applied as 
supposedly teaching detecting computer viruses using a collection of relational data to detect 
computer viruses, fails to cure the deficiencies of Ji et al and Xu as discussed previously, neither 
singly nor in any reasonable combination, and thus the rejection of dependent claims 2-4 and 10- 
12 should also be withdrawn. 

Regarding claims 8 and 16, the Office Action (pp. 6-7) further correctly acknowledges, 
"Ji fails to teach a plurality of scanning computer systems configured to execute respective anti- 
virus scanning software having different, corresponding coverage of malicious code for scanning 
content for malicious code," again making a leap to contend, "However, the examiner asserts that 
the use of multiple virus scanning devices in parallel with different detection software and with 
different coverage of malicious code is well known in the art," then concluding, "It would have 
been obvious to one of ordinary skill in the art to modify Ji's scanning system to incorporate a 
plurality of virus scanning systems differ [sic] in their capabilities be used [sic] as a 'safety net' 
to improve the chances of detecting a virus, Xu, page 18, paragraphs 228 (Xu)." For reasons 
similar to those discussed previously regarding the rejection of claims 1 and 9, and since the 
addition of Wells fails to cure the deficiencies of Ji et al and Xu as discussed previously, the 
rejection of claims 8 and 16 should be withdrawn. If the rejection is maintained in a next Office 
Action, Applicants respectfully request that evidence in support of the "well known in the art" 
assertion be produced in a next Office Action, and that the next Office Action be made non-final, 
to give Applicants a fair opportunity to respond. 

As pointed out in the response filed August 19, 2004 regarding the Office Action dated 
May 19, 2004, Applicants further respectfully submit that many claims are again rejected 
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improperly throughout the outstanding Office Action. As clearly stated by the MPEP § 2141.02, 
"Ascertaining the differences between the prior art and the claims at issue requires interpreting 
the claim language, and considering both the invention and the prior art references as a whole." 
Further, "In determining the differences between the prior art and the claims, the question under 
35 U.S.C. 103 is not whether the differences themselves would have been obvious, but whether 
the claimed invention as a whole would have been obvious. Stratoflex, Inc. v. Aeroquip Corp., 
713 F.2d 1530, 218 USPQ 871 (Fed. Cir. 1983); Schenck v. Nortron Corp., 713 F.2d 782, 218 
USPQ 698 (Fed. Cir. 1983)" 

For example, regarding the rejection of at least claims 22-23, the Office Action 
improperly gives no reasons why the applied references suggest at least claim 22-23, e.g., at Page 
5, lines 1-3, asserting, "Claims 22-23 recites [sic] a detection management system with features 
recited in claims 1, 6 and 7. Claims 22-23 are rejected for the same reasons stated in the 
statement of rejections of claims 1, 6 and 7 above." The Office Action apparently relies again on 
various combinations of words recited in the claims to assemble a rejection based on the 
occurrences of those words in other claims, for example, "Claim 24 is an apparatus reciting 
limitations of claims 1, 2 and 4" at Page 8, lines 5-6. Applicants respectfully submit that claim 
24 depends from claim 22, which the Office Action contends is somehow rejected for the same 
reasons as "claims 1, 6, and 7," but dependent claim 24 supposedly recites "limitations of claims 
1, 2 and 4," which is, at best, vague, inconsistent and confusing. 

Further, the Office Action asserts, "Claims 25-27 recite limitations (broader in scope) of 
apparatus claims 1, 2, 4, 6 and 7," then states, "Claims 25-27 are rejected for the same reasons 
provided in the statement of rejections of claims 1, 2, 4, 6 and 7 above" at Page 8, lines 7-9. 
Applicants respectfully submit that the "statement of rejections of claims 1, 2, 4, 6 and 7" is 
found on pp. 2-3 (claim 1), pp. 5-6 (claims 2, 4), p. 3 (claim 6), and pp. 3-4 (claim 7). 
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Additionally, the Office Action states, "In regards to claims 28-30, the claims limitations recite a 
storage medium having computer programs to execute the steps of 1-4, 6 and 7, therefore the 
same rejection applies" at Page 8, lines 10-12. 

There is no explanation proferred as to how or why any of the applied references, either 
singly or in combination, apply to these claims specifically, other than a combination of 
recitations of "same reasons" for various combinations of claims that were rejected on different 
grounds. 

Similarly, the rejections at least of claim 17 (rejected by stating, "an apparatus (front end 
system) reciting limitations of claims 1 and 6" (Office Action, Page 4)), claim 18 (rejected by 
stating, "a method claim reciting limitations of claims 1 and 6. Claim 17 is rejected for the same 
reasons stated in the rejection of claims 1 and 6 above." (Office Action, Page 4)), claim 19 
(rejected by stating, "a storage medium having instructions to execute the method of claim 18, 
therefore the same rejection applies" (Office Action, Page 4)), and claim 20 (rejected by stating, 
"an apparatus claim reciting limitations of claims 1 and 6" (Office Action, Page 4)) are improper. 

The Patent Office must give specific reasons why one of ordinary skill in the art would 
have been motivated to combine the references. See, e.g., In re Kotzab, 217 F.3d 1365, 1371, 55 
USPQ2d 1313, 1317 (Fed. Cir. 2000); In re Rouffet, 149 F.3d 1350, 1359, 47 USPQ2d 1453, 
1459 (Fed. Cir, 1998). Moreover, Applicants respectfully submit that the reasoning that the 
Examiner puts forth for the rejection with respect to at least claims 17-18, 20, and 22-30 
contravenes 35 U.S.C. § 132, which requires the Director to "notify the applicant thereof, stating 
the reasons for such rejection." This section is violated if the rejection "is so uninformative that 
it prevents the applicant from recognizing and seeking to counter the grounds for rejection." 
Chester v. Miller, 15 USPQ2d 1333 (Fed. Cir. 1990). This policy is captured in the Manual of 
Patent Examining Procedure. For example, MPEP § 706 states that "[t]he goal of examination is 
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to clearly articulate any rejection early in the prosecution process so that applicant has the 
opportunity to provide evidence of patentability and otherwise respond completely at the earliest 
opportunity." Furthermore, MPEP § 706.02(j) indicates that: "[i]t is important for an examiner 
to properly communicate the basis for a rejection so that the issues can be identified early and the 
applicant can be given fair opportunity to respond." Therefore, if a next action maintains these 
rejections, Applicants respectfully request that the next action be made non-final to give the 
Applicants a fair opportunity to respond. 

Thus, for reasons stated above, Applicants respectfully request that the rejection of all 
pending claims be withdrawn. 

Therefore, the present application overcomes the objections and rejections of record and 
is in condition for allowance. Favorable consideration is respectfully requested. If any 
unresolved issues remain, it is respectfully requested that the Examiner telephone the 
undersigned attorney at (703) 425-8508 so that such issues may be resolved as expeditiously as 
possible. 



10507 Braddock Road 
Suite A 

Fairfax, VA 22032 
Tel. (703) 425-8508 
Fax. (703) 425-8518 



Respectfully Submitted, 



DITTHAVONG & CARLSON, P.C. 





Attorney/Agent for Applicant(s) 
Reg. No. 41,946 
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